Skip to content

docs(security): 📝 document private vulnerability reporting #4

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
alsd4git merged 2 commits into from
Oct 31, 2026
Merged

docs(security): 📝 document private vulnerability reporting #4

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
85273f7
docs(security): 📝 document private vulnerability reporting
alsd4git Oct 31, 2026
137bdd8
docs(security): 📝 clarify ownership of exposed credentials
alsd4git Oct 31, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 23 additions & 0 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,23 @@
# Security policy

## Reporting a vulnerability

Use [GitHub private vulnerability reporting](https://github.com/alsd4git/mtls-cli/security/advisories/new).
Do not disclose exploit details or sensitive data in public issues or pull requests.

Include the affected commit or version, expected impact and minimal reproduction
steps. Use synthetic examples and redact screenshots and logs. If your own
credential was exposed, revoke or rotate it. Report credentials you do not control
promptly and privately; do not use or attempt to revoke them.

## Versions and maintenance

Check the current default branch, `main`, and, if using a release,
the latest release published by this repository before reporting an issue.
Fixes, when provided, target the default branch. Older versions do not receive
separate backports. Reports are handled on a best-effort basis without guaranteed
response or remediation times.

## Safe reproduction

Use temporary stores, test CAs and disposable certificates. Never include production private keys, passphrases or real certificate packages. Do not issue or revoke production certificates to demonstrate an issue.
Loading